Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-49352: 9router's Default Secret Allows Unauthenticated Access
GHSA-jphh-m39h-6gwx
CVE-2026-49352
CVE-2026-49352
Summary
9router's default secret is hardcoded and publicly known, allowing unauthorized users to access the dashboard and API if the server's JWT secret is not set. This vulnerability affects many public 9router servers, and users should ensure they set a custom JWT secret to prevent unauthorized access. To protect your server, set a custom JWT secret and do not use the default one.
What to do
- Update decolua 9router to version 0.4.45.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | decolua | 9router |
>= 0.2.21, <= 0.4.41 Fix: upgrade to 0.4.45
|
| – | decolua | 9router | >= 0.2.21, < 0.4.44 |
Original title
9Router: Hardcoded Default fallback JWT Secret Allows Authentication Bypass
Original description
9Router is an AI router & token saver. From 0.2.21 until 0.4.44, 9Router used the hardcoded fallback JWT secret 9router-default-secret-change-me in src/app/api/auth/login/route.js, src/middleware.js, and later src/lib/auth/dashboardSession.js, allowing attackers to forge an auth_token cookie when JWT_SECRET was unset. This issue is fixed in version 0.4.44
ghsa CVSS3.1
9.8
Vulnerability type
CWE-798
Use of Hard-coded Credentials
Published: 15 Jul 2026 · Updated: 20 Jul 2026 · First seen: 2 Jul 2026